Gabriel Radureau bbac3e7ff9 🐛 fix(ci): replace ${{ head_commit.message }} expression with git log to avoid shell injection ...

PR #31 added a fallback to git log -1 --pretty=%B for the workflow_dispatch
case (where head_commit.message is empty), but kept ${{ ... }} as the primary
source. That expression is interpolated literally into the rendered shell
script — so a commit body containing a backtick, an unbalanced quote, or even
just a newline at an unfortunate position breaks the line that follows.

Symptom: every PR since #31 has shown:
  /var/run/act/workflow/12.sh: line 34: syntax error: unexpected newline
  ❌  Failure - Main Update badges and version (multiple commits, single push)

Fix: skip the expression entirely. git log -1 --pretty=%B reads the same
information from the actual commit and has no shell-injection surface.

2026-05-05 07:29:10 +02:00

13 KiB

Raw Blame History

View Raw